Shiftycode ( 🩸🩸 481 pt, 11 solve )

TL;DR : simple vm

The vmcode file bin and binary shiftycode are given,

Seeing the decompile code, It read the vm codes from the filename in command line argument.

And execute the vm codes

I copied the part that runs the vm code in decompiled code,

and I changed the C code to Python little by little

Untitled

on the 108th, 117th line, those are Condition Statement which exit when I input wrong FLAG in ar

But if I annotate the above two lines, I can see the full opcodes.

Untitled

ar[0]~ar[26] is user input

Untitled

I input correct flag in ar, so the flags will be always False.

So all the Condition Statement can be passed

Annotating the two Condition Statement,

I can see all the Flag comparing opcode and Condition.

Input all the conditions in z3, I can get the flag

This post is licensed under CC BY 4.0 by the author.